Email-Worm.Win32.Warezov.do

Technical Details

This modification of Warezov is a component used by other variants of the Warezov family.

It is sent via email by the worm. It is a Windows PE EXE file. It is 30,724 bytes in size. It is packed using UPX. The unpacked file is approximately 67KB in size.

Installation

When launched, Warezov.do causes the following message to be displayed:

The worm may also drop a file with a .tmp extension to its working directory, and open this file using Notepad:

When launched, the worm copies its executable file to the Windows system directory under a random name composed of Latin capital letters.

Payload

This modification of Warezov spreads via email. The main function of this variant is to download and install the most recent variant of Warezov to the victim machine.

The worm downloads a file from the following link:

http://www6.vedasetionkderun.com/***/819/nt.exe

At the time of writing, this link was not working.

The downloaded file will be saved to the Windows temporary directory. The file will then be launched for execution.

The worm is able to terminate a range of processes, and to stop and delete services related to antivirus solutions and firewalls.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the process associated with the original worm file.
2. Delete the original worm file (the location will depend on how the program originally penetrated the victim machine).
3. Manually delete the copy of the worm from the Windows system directory.
4. Delete the contents of %Temp%
5. Delete all infected messages from all mail folders.
6. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).